1. Field of the Invention
The present invention relates to a method of verifying an electronic signature. More particularly, the present invention relates to a method in which a degree of difference (cumulative error) between registered signature data and signature date to be verified is obtained during verification, and a signer is authenticated on the basis of the degree of difference, as well as to a method and apparatus for electronic-tablet correction.
2. Discussion of the Background
A handwritten character recognition method by which written characters are recognized has been utilized as an input method for word processors or a signature verification method for specifying a writer. Under a handwritten character recognition method which has already been in actual use as an input method, characters are input under specified constraints on the style of typeface (e.g., in the style of Kaisho in the case of Japanese), and the thus-input characters are converted into coordinate information. The thus-converted coordinate information is verified by comparison with coordinate information relating to character data which have been stored beforehand. As a result of verification, the characters are recognized as matched. If characters are carefully written in the kaisho style at comparatively slow speed in the manner as previously described, the characters can be sufficiently recognized through use of only coordinate information because under such conditions each of the strokes of the characters becomes clear by virtue of visual feedback to the writer and hence the shape of the characters becomes stable.
In contrast, in a case where the character recognition method is applied to an input method which does not pose any restriction on the style of typeface at the time of input of characters or to a signature verification method, there must be recognized not only characters written in the kaisho style but also cursively written characters. When characters are cursively written, writing motion becomes faster and does not involve any substantial visual feedback to the writer. In this case, the characters become less identifiable, and separation of a resultantly acquired pattern into strokes becomes difficult. Further, due to a large expansion or contraction of the pattern in the direction of the time axis or in the direction of stroke and/or the difference between the input pattern and a pre-registered pattern in these directions, a matching rate is extremely low, rendering recognition of characters difficult.
Another method is to enable recognition of characters without involving the separation of characters into strokes by application of time-series coordinate information and writing pressure. This method employs-a pattern matching technique called dynamic programming (DP) matching, which takes into consideration variations in the coordinate information stemming from variations in writing action.
In the DP matching technique, variations in the writing motion are corrected with regard to the time axis or the arc length axis through use of a skew function which minimizes a cumulative error between patterns to be checked. Patterns are matched with each other on the basis of the coordinates and writing pressure that have been corrected so as to compensate variations in the writing motion, thereby enabling recognition of cursively handwritten characters.
Verification based on the addition of writing-pressure information to time-series coordinate information or normalization of input patterns by DP matching contributes to an improvement in the recognition rate of handwritten characters. However, in the case of application of the DP matching technique to recognition of cursively written characters or signature verification, a false signature may be erroneously recognized as a genuine signature. Therefore, in its present form, the DP matching technique cannot be put into practical use.
Japanese Patent No. 1,822,532 [Japanese Patent Publication (kokoku) No. 5-31798] entitled xe2x80x9cA Method of Recognizing Handwritten Characters Onlinexe2x80x9d describes a practical technique that is based on DP matching. Under this method, when the degree of difference between a registered pattern and an input pattern of handwritten characters is calculated by use of DP matching, time-series coordinate information and writing-pressure information are simultaneously processed by the assignment of optimum weighting coefficients to the time-series coordinate information and writing-pressure information. As a result, the difference is reduced, which in turn contributes to an improvement in the verification rate of authenticity and a reduction in processing time.
As mentioned previously, even in the case of unclear characters which cannot be separated into strokes, processing of the time-series coordinate information and writing-pressure information relating to handwritten characters enables recognition of the characters. Further, even in the case of cursively handwritten characters, the characters can be recognized in practice, as a result of a further improvement in the DP matching technique that compensates variations in writing motion in order to correct cumulative errors.
In a static signature verification system, an image scanner or an image OCR is used as a tool for reading characters. In contrast, in a dynamic signature verification system, a stylus pen is generally used. An appearance of such a dynamic signature verification system utilizing a stylus pen is shown. When characters are written on a tablet through use of a stylus pen, signals representing characters are sent to a verification section, where signature verification is performed.
Such a tablet and stylus pen are important devices that affect easiness of use. Therefore, recently these devices have been improved. For example, a tablet formed from a liquid-crystal panel and a wireless stylus pen having no signal cable have come into use. Further, in place of a piece of hardware dedicated to signature verification, a personal computer has come into use. In this case, signature verification is performed by software.
The processing performed in the verification section is composed of three steps; i.e., pre-processing/normalization, character extraction, and recognition/judgment. Information from the stylus pen includes relative coordinates (x, y) relative to the start point of a signature, and writing pressure p.
Since handwritten characters are not necessarily consistent, verification of a signature involves difficulty caused by variation in the direction of writing and in size, and hardware noise. The pre-processing/normalization removes these variations and noise and performs normalization in order to enable comparison with standard character patterns. Specifically, in the pre-processing, there are performed removal of excess series of points (sampling based on amount of relative movement), removal of random noise that depends on hand shake and resolution of a tablet (smoothing through load shift), removal of isolated data caused by erroneous operation of the tablet, and like operations. After completion of such pre-processing, the size and position of input characters are normalized. Subsequent to the above-described processing, characteristics of the characters are extracted, and recognition/judgment processing is performed.
The above-described method for verifying electronic signatures is realistic and practical. However, such signature verification involves many drawbacks to be solved. One of the drawbacks is that a signature is not necessarily consistent.
Handwriting of a signature varies depending on the mental state of the person signing and the circumstances under which the person signs. How can we authenticate a person while absorbing such variations? How can we avoid a possibility that a third person whose imitates the handwriting of a certain person is authenticated as the certain person? These difficulties result in two types of errors in relation to signature verification; i.e., an error in which a certain person is judged to be another person (exclusion of the true person) and an error in which a person other than a certain person is judged to be the certain person (authentication of another person).
In signature verification, a person inputs signature data by signing on an electronic tablet by use of an electronic pen, which data are collated with previously registered signature data of the person by means of DP matching. However, since only the shape of a signature is collated in conventional signature verification schemes, characteristics of an electronic tablet and an electronic pen (hereinafter referred to as a xe2x80x9csigning devicexe2x80x9d) have not been taken into consideration.
The size, inclination, etc., of characters are not affected by the characteristics of the signing device, because corresponding input signature data are normalized. However, because the handwriting of a signature is easily imitated in shape, signature verification on the basis of only shape is not safe. One method for solving such a problem is addition of writing-pressure information to shape information. Writing pressure cannot be determined from the appearance of a signature and depends on characteristics of a signer. Writing pressure is difficult for other persons to imitate. Thus, combined use of writing-pressure information and shape information enables stricter authentication of a person.
In such case, differences in characteristics among signing devices cause a problem. Although no problem arises when the same signing device is used, a problem arises in the current multimedia environment in which each person uses a signing device of a different manufacturer. In this case, writing-pressure information varies depending on the type of a signing device. In an exemplary case in which a person uses a signing device A for inputting registration signature data serving as a reference for signature verification and uses a signing device B for inputting signature data to be verified, the signing devices A and B output different writing-pressure information even when the person has signed with the same force. Therefore, writing-pressure informationxe2x80x94which is employed because of inherent difficulty in imitation by other personsxe2x80x94excludes a true person as well as other persons.
An object of the present invention is to provide a method which solves the above-described problems and enables stable signature verification which provides a higher matching or verification rate.
In order to solve the above-described problem, preparation of registration signature data, input of signature data to be verified (verification signature data), and verification taking into consideration characteristics of a signing device (an electronic pen or an electronic tablet) are performed in the following manner.
That is, there is provided an electronic signature verification method in which data of a handwritten character string of a signer are fetched; registration signature data of the signer set in advance are retrieved; the data of the handwritten character string are compared with the registration signature data; and a verification judgment is performed by use of separate regions including a region in which the signature is recognized to be true and a region in which the signature is not recognized to be true. When the signer sets the registration signature data, the registration signature data are set, by appropriate means, from a plurality of signature data sets for registration. The region in which the signature is recognized to be true is determined on the basis of the distribution of cumulative errors between the registration signature data and the plurality of signature data sets for registration, such that the region in which the signature is recognized to be true becomes wider when the distribution is wide and becomes narrower when the distribution is narrow.
There is further provided an electronic signature verification method in which data of a handwritten character string of a signer are fetched; registration signature data of the signer set in advance are retrieved; the data of the handwritten character string are compared with the registration signature data; and a verification judgment is performed by use of separate regions including a region in which the signature is recognized to be true, a region in which the signature is not recognized to be true, and an intermediate region in which re-signing is requested due to impossibility of judgment. The intermediate region in which re-signing is requested is determined on the basis of the distribution of cumulative errors between the registration signature data and the plurality of signature data sets for registration, such that the intermediate region becomes wider when the distribution is wide and becomes narrower when the distribution is narrow.
The above-described two methods are combined so as to provide an electronic signature verification method in which data of a handwritten character string of a signer are fetched; registration signature data of the signer set in advance are retrieved; the data of the handwritten character string are compared with the registration signature data; and a verification judgment is performed by use of separate regions including a region in which the signature is recognized to be true, a region in which the signature is not recognized to be true, and an intermediate region in which re-signing is requested due to impossibility of judgment, wherein the region in which the signature is recognized to be true and the intermediate region in which re-signing is requested are determined on the basis of the distribution of cumulative errors between the registration signature data and the plurality of signature data sets for registration, such that the region in which the signature is recognized to be true becomes wider when the distribution is wide and becomes narrower when the distribution is narrow and such that the intermediate region becomes wider when the distribution is wide and becomes narrower when the distribution is narrow.
Further, in the above-described methods, data of a handwritten character string of a signer and signature data sets for registration may be corrected on the basis of correction information for each of different signing devices in order to absorb differences among the input devices.
As described above, when signature data are to be registered, a person signs a plurality of times by use of a signing device. The thus-obtained data are fetched as time-series signature data including writing pressure information; characteristics which are peculiar to the signer and necessary for personal authentication are extracted in order to create registration signature data; and the thus-created registration signature data are registered in a master file. At this time, the registration signature data are collated again with a plurality of signature data sets to obtain cumulative errors (degree of difference). On the basis of the distribution of errors, a security level and a gray zone (intermediate region) corresponding to the stability of signatures of the signer are determined and registered. Further, at this time, writing-pressure informationxe2x80x94which varies depends on the type of a signing device usedxe2x80x94is converted into writing-pressure information of a signing device serving as a reference, in order to obtain correction information for each of different signing devices. The thus-obtained correction information is registered.
In the signature verification of the present invention, the sum of absolute values of differences between coordinate values contained in registration signature data and coordinate values contained in verification signature data is calculated and the values are averaged so as to obtain an error for each sample point. The thus-obtained error is called a cumulative error (degree of difference). On the basis of the degree of difference, a judgment is made as to whether a signature is a true signature (i.e., a signer is recognized to be a true person)) or not a true signature (i.e., the signer is rejected as a person other than the true person).
At this time, a relatively high clear line is set for a person who signs at high stability, and a relatively low clear line is set for a person who signs at low stability. This clear line is called a xe2x80x9ctrue-person exclusion line.xe2x80x9d The lower the set value of the true-person exclusion line, the higher the security level that can be obtained; and the higher the set value of true-person exclusion line, the lower the security level that can be obtained. Data for the above-described signature verification are stored for each person and can be retrieved at the time of verification.
FIG. 1 is a diagram showing a cumulative-error frequency distribution and a true-person exclusion line. The horizontal axis of the coordinate system represents the degree of difference (cumulative error) in which the higher the value, the lower the probability of a signer being a true person, or the lower the value, the higher the probability of a signer being a true person. The origin O (0, 0) of the coordinate system is a reference point representing registration signature data themselves. When the degree of difference between verification signature data and registration signature data becomes zero, the verification signature data are judged to be identical with the registration signature data.
A curve representing the cumulative-error frequency distribution (hereinafter referred to as a xe2x80x9cdifference distribution curvexe2x80x9d) is normalized such that the area below the curve equals 1. A point which bisects the area below the curve is a centroid and is typically located in the vicinity of a position corresponding to the peak of the curve. When the area of a region on the left side of the true-person exclusion line is represented by S1, and the area of a region (hatched portion) on the right side of the true-person exclusion line is represented by S2, a probability r of a true person being excluded can be obtained as follows:                     r        =                              S            2                    /                      (                                          S                1                            +                              S                2                                      )                                                            =                      S            2                          ,                  xe2x80x83                ⁢                                            because              ⁢                              xe2x80x83                            ⁢                              S                1                                      +                          S              2                                =          1.                    
That is, a true person is recognized not to be a true person at the probability r. Although the difference distribution varies among persons, the true-person exclusion line can be drawn such that the probability r becomes constant, thereby enabling each of stable and unstable signers to be recognized as a true person at a constant probability. However, in a simple scheme in which a signer is recognized to be another person on the right side of the true-person exclusion line and is recognized to be a true person on the left side of the true-person exclusion line, there is a high risk that a signature of a person having a relatively low security level is imitated by other persons.
FIG. 2 shows a difference distribution of person A who can sign stably and a difference distribution of person B who cannot sign stably. In the case of this example, in order to increase the signature matching rate of person B, the true-person exclusion line for person B is drawn such that the area of the region on the left side of the true-person exclusion line becomes wider. This increases the possibility that any other person who imitates a signature of the true person is recognized to be the true person. Accordingly, there is a risk that other persons cannot be excluded by mere use of a true-person exclusion linexe2x80x94which is introduced in order to increase the probability of a true person being authenticated and which takes security level into consideration.
In order to solve this problem, the present invention employs an other-person exclusion line. FIG. 3 shows the relationship between an other-person exclusion line and a true-person exclusion line. A region sandwiched between the two lines is called a gray zone. In FIG. 3, a region on the right side of the true-person exclusion line is called a true-person exclusion region. When a result of signature verification indicates that a cumulative error (degree of difference) falls within the true-person exclusion region, the signature is recognized to be signed by a person other than the true person, even if the true person has signed.
Meanwhile, a region on the left side of the other-person exclusion line is called an other-person exclusion region, because signatures whose cumulative errors fall within this region can rarely be imitated by other persons. When the cumulative error falls within this region, the signer is determined to be a true person. The meaning of exclusion of other person will become clear upon reference to FIG. 4, which shows a difference distribution for the case in which a person other than the true person signs. In the graph of FIG. 4, although the value of frequency does not reach zero even on the left side of the other-person exclusion line, the value indicated by time-series signature data including writing-pressure information becomes substantially zero.
The gray zone sandwiched between the true-person exclusion line and the other-person exclusion line is a vague area in which it is impossible to judge whether a true person signed or a person other than the true person signed. When a result of signature verification indicates that the degree of difference falls within the gray zone, re-signing is requested, and signature verification is performed again for the new signature. On the basis of a result of the signature verification, a signer is judged to be a true person or a person other than the true person. For example, when the result of the signature verification for the new signature indicates that the degree of difference falls within the other-person exclusion region, the signer is recognized to be the true person, and when the result indicates that the degree of difference falls within the true-person exclusion region, the signer is recognized to be another person. When the degree of difference again falls within the gray zone, a judgment is automatically performed again. In this case, the signer is preferably judged to be another person if importance is placed on strictness.
The present invention employs a method for performing total judgment by use of a concept of security level and a concept of gray zone in a related manner such that the judgment for the gray zone is changed in accordance with the security level. This point will be described in detail in relation to an embodiment.
In the above-discussion, passage or failure of a verification test (whether the signer is a true person or not) is determined on the basis of a region in which the degree of difference falls. However, the following point must be considered in relation to verification signature data. Since writing-pressure information varies depending on the performance of an electronic pen or electronic tablet used for signing, differences in input characteristics must be corrected in the case in which verification signature data include not only shape but also writing pressure, as in the present invention.
In general, as shown in FIG. 5, a proportional relationship exists between actual writing pressure and measured writing pressure as read from an electronic pen or electronic tablet. When electronic tablets or pens A, B, and C output measured writing pressures pA, pB, and pC, respectively, for actual writing pressures p, correction values xcex1A, xcex1B, and xcex1C for the measured writing pressures pA, pB, and pC with respect to a measured writing pressure pN from a reference electronic tablet or pen N are represented as follows:             α      A        =                  p        A            /              p        N                        α      B        =                  p        B            /              p        N                        α      C        =                  p        c            /              p        N            
When the relationship between actual writing pressure and measured writing pressures can be approximated by use of straight lines as shown in FIG. 5 and the lines pass through the origin O, the correction value xcex1 is constant regardless of the value of p. Therefore, measured writing pressure can be corrected by use of a correction value obtained from the above expressions. That is, when a writing pressure Ps which is applied on an electronic pen or tablet S at a certain time and which is represented by verification signature data is represented as follows:
PS=(xst, yst, pst)
a corrected writing pressure Psxe2x80x2 is represented as follows:
Psxe2x80x2=(xst, yst, pstxc2x7xcex1S)
Accordingly, when corrected verification signature data Psxe2x80x2 are compared with corrected registration signature data, verification can be performed without regard to the type of an electronic tablet or pen to be used. In the following description, unless otherwise specified, the term xe2x80x9cwriting pressurexe2x80x9d means measured writing pressure (writing-pressure information). Although correction is performed for measured writing pressure output from an electronic tablet or an electronic pen, in the following description such correction will be simply referred to as xe2x80x9ctablet correction.xe2x80x9d
The above-described tablet correction assumes that the relationship between actual writing pressure and measured writing pressure can be approximated by use of a straight line. However, when a tablet whose characteristics cannot be approximated by use of a straight line is used, a curved-line approximation or a correction table may be used. However, the basic concept is the same as in the case of straight-line approximation.